From 674046b1a8644e430476d05a9399d5e3792c957e Mon Sep 17 00:00:00 2001
From: Lann Martin <lmartin@akamai.com>
Date: Thu, 6 Aug 2026 09:43:25 -0400
Subject: [PATCH 1/2] Skip the TLS pin fetch when the clone already carries the
 commit

---
 conformance/driver-ct/justfile | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/conformance/driver-ct/justfile b/conformance/driver-ct/justfile
index 6b5aa46..7af7fd8 100644
--- a/conformance/driver-ct/justfile
+++ b/conformance/driver-ct/justfile
@@ -69,7 +69,13 @@ build-tls-component:
         git clone https://github.com/polymorph-components/polymorph-tls "$dir"
     fi
     if [ "$(git -C "$dir" rev-parse HEAD)" != "$rev" ]; then
-        git -C "$dir" fetch origin "$rev"
+        # A fresh clone already carries every commit reachable from a
+        # branch, so the pin normally needs no fetch. GitHub's upload-pack
+        # serves fetch-by-sha only best-effort for non-tip commits, so when
+        # the object is missing, fall back to fetching the branches that
+        # make the pin reachable.
+        git -C "$dir" cat-file -e "$rev^{commit}" 2>/dev/null || \
+            git -C "$dir" fetch origin "$rev" || git -C "$dir" fetch origin
         git -C "$dir" checkout --detach "$rev"
     fi
     cd "$dir"

From 84cf86ec0510120a5c34b8c02a6e981a4a0a1167 Mon Sep 17 00:00:00 2001
From: Lann Martin <lmartin@akamai.com>
Date: Thu, 6 Aug 2026 09:49:15 -0400
Subject: [PATCH 2/2] Re-clone the TLS pin checkout when it cannot produce the
 pin

---
 conformance/driver-ct/justfile | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/conformance/driver-ct/justfile b/conformance/driver-ct/justfile
index 7af7fd8..e1492e5 100644
--- a/conformance/driver-ct/justfile
+++ b/conformance/driver-ct/justfile
@@ -64,19 +64,21 @@ build-tls-component:
     set -euo pipefail
     rev="$(cat {{root}}/rust/guest-provider/tls-component.rev)"
     dir={{root}}/target/deps/component-tls
-    if [ ! -d "$dir/.git" ]; then
+    clone() {
+        rm -rf "$dir"
         mkdir -p "$(dirname "$dir")"
         git clone https://github.com/polymorph-components/polymorph-tls "$dir"
-    fi
-    if [ "$(git -C "$dir" rev-parse HEAD)" != "$rev" ]; then
-        # A fresh clone already carries every commit reachable from a
-        # branch, so the pin normally needs no fetch. GitHub's upload-pack
-        # serves fetch-by-sha only best-effort for non-tip commits, so when
-        # the object is missing, fall back to fetching the branches that
-        # make the pin reachable.
+    }
+    [ -d "$dir/.git" ] || clone
+    if [ "$(git -C "$dir" rev-parse HEAD 2>/dev/null)" != "$rev" ]; then
+        # A clone carries every commit reachable from a branch, so the pin
+        # normally needs no fetch, and GitHub's upload-pack serves
+        # fetch-by-sha only best-effort for non-tip commits. A checkout that
+        # cannot produce the pin even so (e.g. an object store mangled by
+        # target/ caching) is disposable build territory: re-clone.
         git -C "$dir" cat-file -e "$rev^{commit}" 2>/dev/null || \
-            git -C "$dir" fetch origin "$rev" || git -C "$dir" fetch origin
-        git -C "$dir" checkout --detach "$rev"
+            git -C "$dir" fetch origin "$rev" || true
+        git -C "$dir" checkout --detach "$rev" || { clone; git -C "$dir" checkout --detach "$rev"; }
     fi
     cd "$dir"
     cargo build --release --target wasm32-wasip2 -p polymorph-tls-component